nats, kafka-metadata and rabbitmq backup demos share the empty-read defects fixed for redis #4400

The nats, kafka-metadata and rabbitmq backup demos have the same two defects that failed the redis demo in #4395. #4399 fixes redis only. Paths are at origin/main 90a1a94.

The first is a kubectl run --rm -i read that can come back empty with exit code 0. That happens when the CLI pod writes its answer before the attach is registered: kubectl falls back to logs only when the attach fails (run.go:484-490 in kubectl v1.33), and containerd does not replay output written before a live attach. The copies are in examples/backups/nats/00-helpers.sh:96 and examples/backups/kafka-metadata/00-helpers.sh:211. In the redis demo this caused four of seven failures of redis-2-backup-roundtrip since 2026-09-21. #4399 switches that read to kubectl exec into a running pod, where the pipes exist before the process starts.

The second is a single read of the platform's cozy-default-* strategy. Right after install that object can still be missing, because the backupstrategy-controller upgrade that renders it waits on dependsOn until cozystack-basics is Ready. The copies are in examples/backups/rabbitmq/run-all.sh:123 and examples/backups/kafka-metadata/run-all.sh:50. #4399 replaces the redis one with kubectl wait --for=create.

I have not checked whether these suites have already failed this way. The mechanism is the same, so the fix from #4399 should carry over.